Regulations amending certain regulations made under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act , 2018

Submission of the Office of the Privacy Commissioner of Canada to Finance Canada

---

September 7, 2018

Lynn Hemmings
A/Director General
Financial Systems Division
Financial Sector Policy Branch
Department of Finance Canada
90 Elgin Street
Ottawa, Ontario K1A 0G5

Dear Ms. Hemmings:

Subject: Regulations Amending Certain Regulations Made Under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), 2018

1. The Office of the Privacy Commissioner of Canada (OPC) appreciates the opportunity to provide comments to the Department of Finance Canada (Finance Canada) in the context of its consultation on proposed amendments to the PCMLTFA Regulations as published in the Canada Gazette on June 9, 2018.  
2. By way of background, the mandate of the OPC is to oversee compliance with both the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's private-sector privacy law, along with some aspects of Canada's anti-spam law.  Under section 72(2) of the PCMLTFA, the OPC is also required to review measures taken by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) to protect information it receives or collects. The OPC's mission is to protect and promote the privacy rights of individuals.
3. While our Office supports efforts to combat money laundering and terrorist financing, we believe it is crucial that these efforts are and can be shown to be proportional. With respect to our general concerns with Canada’s Anti-Money Laundering/Anti-Terrorist Financing (AML/ATF) regime, I would draw your attention to the Privacy Commissioner’s February 2018 appearance on the statutory review of the PCMLTFA before the House Standing Committee on Finance, in which we stressed the importance of striking an appropriate balance between the need to combat money laundering and terrorist financing and the need to respect the privacy rights of Canadians.^{Footnote 1}
4. The Regulatory Impact Assessment Statement (RIAS) identifies the Financial Action Task Force (FATF) reports and recommendations as the source of many of the changes proposed in these Regulations. While we acknowledge that international coordination is desirable and necessary to combat AML/ATF, we encourage the Government to advocate at the FATF in support of it engaging in dialogue with international data protection authorities to minimize the risk of over-collecting and retaining the financial and personal information of law-abiding individuals.
5. The OPC believes that actions taken to strengthen the financial framework in Canada cannot be accomplished without equal attention being given to how the changes impact privacy rights of Canadians. As such, we continue to advocate for thorough risk-based analysis of data at point of collection, accompanied by criteria to limit collection, sharing and retention to only situations likely to represent potential manifestations of terrorist financing or money laundering.
6. To that end, I would suggest that in order to ensure proportionality, discussions with our Office should occur prior to finalization and implementation of these new Regulations. Issues for discussion include the requirement to collect IP addresses and Unique Device Indicators, broadening the scope and data points collected to report on Electronic Funds Transfers, as well as the new Beneficial Ownership requirements. In that way, we can work together to ensure a proper balance between protecting the privacy rights of Canadians and meeting Canada’s obligations regarding a strong AML/ATF regime.
7. We appreciate the opportunity to share our views and would be pleased to engage with your Officials on any of the issues raised in this submission.

Sincerely,

(Original signed by) 

Barbara Bucknell
Director, Policy, Research, and Parliamentary Affairs